a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4

max time kernel
246s
max time network
297s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
13-04-2024 09:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe
Size

483KB
MD5

3265b2b0afc6d2ad0bdd55af8edb9b37
SHA1

24272beb676d956ec8a65b95a2615c9075fa9869
SHA256

a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4
SHA512

28f99da799b43a5fd060b5cab411911b54ceeb51e612ec6213c2b8003ee6de29bc46683ba04507c0e8a92e9fbec4be5cecbc8918618db9c15f231a5be806cb94
SSDEEP

12288:JF+dRkCGjzKd5Ik6ZDEyyq8Me0KzYB3IvClBTn:JF+deC2+d5AZLde0KcBU4BT

Score

9^/10

persistence ransomware

Malware Config

Signatures

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490
Loads dropped DLL 1 IoCs

Processes:

a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe

pid process

420 a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Run\Mouse Application = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe"	a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe

description	ioc	process
File opened (read-only)	\??\I:	a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe
File opened (read-only)	\??\J:	a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe
File opened (read-only)	\??\G:	a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe
File opened (read-only)	\??\H:	a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

1 api.ipify.org
Uses Tor communications 1 TTPs
Malware can proxy its traffic through Tor for more anonymity.

Proxy
T1090
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2764 420 WerFault.exe a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

4256 schtasks.exe

flow	ioc
1	api.ipify.org

pid	pid_target	process	target process
2764	420	WerFault.exe	a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe

pid	process
4256	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe

pid	process
420	a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe
420	a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

Processes:

WMIC.exevssvc.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	4784	WMIC.exe
Token: SeSecurityPrivilege	4784	WMIC.exe
Token: SeTakeOwnershipPrivilege	4784	WMIC.exe
Token: SeLoadDriverPrivilege	4784	WMIC.exe
Token: SeSystemProfilePrivilege	4784	WMIC.exe
Token: SeSystemtimePrivilege	4784	WMIC.exe
Token: SeProfSingleProcessPrivilege	4784	WMIC.exe
Token: SeIncBasePriorityPrivilege	4784	WMIC.exe
Token: SeCreatePagefilePrivilege	4784	WMIC.exe
Token: SeBackupPrivilege	4784	WMIC.exe
Token: SeRestorePrivilege	4784	WMIC.exe
Token: SeShutdownPrivilege	4784	WMIC.exe
Token: SeDebugPrivilege	4784	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4784	WMIC.exe
Token: SeRemoteShutdownPrivilege	4784	WMIC.exe
Token: SeUndockPrivilege	4784	WMIC.exe
Token: SeManageVolumePrivilege	4784	WMIC.exe
Token: 33	4784	WMIC.exe
Token: 34	4784	WMIC.exe
Token: 35	4784	WMIC.exe
Token: 36	4784	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4784	WMIC.exe
Token: SeSecurityPrivilege	4784	WMIC.exe
Token: SeTakeOwnershipPrivilege	4784	WMIC.exe
Token: SeLoadDriverPrivilege	4784	WMIC.exe
Token: SeSystemProfilePrivilege	4784	WMIC.exe
Token: SeSystemtimePrivilege	4784	WMIC.exe
Token: SeProfSingleProcessPrivilege	4784	WMIC.exe
Token: SeIncBasePriorityPrivilege	4784	WMIC.exe
Token: SeCreatePagefilePrivilege	4784	WMIC.exe
Token: SeBackupPrivilege	4784	WMIC.exe
Token: SeRestorePrivilege	4784	WMIC.exe
Token: SeShutdownPrivilege	4784	WMIC.exe
Token: SeDebugPrivilege	4784	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4784	WMIC.exe
Token: SeRemoteShutdownPrivilege	4784	WMIC.exe
Token: SeUndockPrivilege	4784	WMIC.exe
Token: SeManageVolumePrivilege	4784	WMIC.exe
Token: 33	4784	WMIC.exe
Token: 34	4784	WMIC.exe
Token: 35	4784	WMIC.exe
Token: 36	4784	WMIC.exe
Token: SeBackupPrivilege	4996	vssvc.exe
Token: SeRestorePrivilege	4996	vssvc.exe
Token: SeAuditPrivilege	4996	vssvc.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.execmd.execmd.exe

description	pid	process	target process
PID 420 wrote to memory of 2288	420	a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe	cmd.exe
PID 420 wrote to memory of 2288	420	a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe	cmd.exe
PID 420 wrote to memory of 2288	420	a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe	cmd.exe
PID 420 wrote to memory of 4328	420	a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe	cmd.exe
PID 420 wrote to memory of 4328	420	a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe	cmd.exe
PID 420 wrote to memory of 4328	420	a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe	cmd.exe
PID 2288 wrote to memory of 4256	2288	cmd.exe	schtasks.exe
PID 2288 wrote to memory of 4256	2288	cmd.exe	schtasks.exe
PID 2288 wrote to memory of 4256	2288	cmd.exe	schtasks.exe
PID 4328 wrote to memory of 4784	4328	cmd.exe	WMIC.exe
PID 4328 wrote to memory of 4784	4328	cmd.exe	WMIC.exe
PID 4328 wrote to memory of 4784	4328	cmd.exe	WMIC.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe
"C:\Users\Admin\AppData\Local\Temp\a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:420

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C schtasks /Create /SC MINUTE /TN "Mouse Application" /TR "C:\Users\Admin\AppData\Local\Temp\a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:2288

C:\Windows\SysWOW64\schtasks.exe
schtasks /Create /SC MINUTE /TN "Mouse Application" /TR "C:\Users\Admin\AppData\Local\Temp\a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe" /f
3⤵
- Creates scheduled task(s)
PID:4256

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C wmic SHADOWCOPY DELETE & wbadmin DELETE SYSTEMSTATEBACKUP & bcdedit.exe / set{ default } bootstatuspolicy ignoreallfailures & bcdedit.exe / set{ default } recoveryenabled No
2⤵
- Suspicious use of WriteProcessMemory
PID:4328

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic SHADOWCOPY DELETE
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 420 -s 1892
2⤵
- Program crash
PID:2764

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4996

C:\Users\Admin\AppData\Local\Temp\a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe
C:\Users\Admin\AppData\Local\Temp\a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe
1⤵
PID:64

C:\Users\Admin\AppData\Local\Temp\a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe
C:\Users\Admin\AppData\Local\Temp\a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe
1⤵
PID:652

C:\Users\Admin\AppData\Local\Temp\a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe
C:\Users\Admin\AppData\Local\Temp\a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe
1⤵
PID:4564

C:\Users\Admin\AppData\Local\Temp\a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe
C:\Users\Admin\AppData\Local\Temp\a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe
1⤵
PID:4324

C:\Users\Admin\AppData\Local\Temp\a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe
C:\Users\Admin\AppData\Local\Temp\a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.exe
1⤵
PID:824

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Proxy

T1090

Impact

Inhibit System Recovery

T1490

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\a188e147ba147455ce5e3a6eb8ac1a46bdd58588de7af53d4ad542c6986491f4.log
Filesize
727B

MD5
a09ffd1537d70648e9cadf83ee4fd128

SHA1
7900a00e33e10f5bab8f7cb81ee86bc14ffff0fd

SHA256
e21bfae7982c0194ec504c4adb4b162ae9531f1f55783f9c6d70658569f8fa34

SHA512
0e77dd335e6525ddcce16216190c031ec1f5a90b73cf33aca05cc36e77ed97a734ec012ce99859a3d3cf83c1de9bd3b558525dc51b10b5366bd28b9facd99c12

Download Submit
\Users\Admin\AppData\Local\Temp\tor-lib.dll
Filesize
38KB

MD5
dc7e564809d6c2a2f3457c3c9b91f22b

SHA1
f28c63fc7ac58162c27428a179d2113200814e7e

SHA256
9969c1e4cf32d1fe6140d6fabf63b6b093a6c6ff7045a187b14175d46cfb74a0

SHA512
f37a46895062318aef808c65bd2a074c8177b6e90f9368aae1892db837f7962c4ed1d75ba34c533895f096d3d71b56aecdb6eafbf61b3ecd50b0d4e8c79021f0

Download Submit